Jens Geyer created THRIFT-6266:
----------------------------------
Summary: Python: THttpServer accepts Content-Length values that
are not valid HTTP numbers
Key: THRIFT-6266
URL: https://issues.apache.org/jira/browse/THRIFT-6266
Project: Thrift
Issue Type: Bug
Components: Python - Library
Reporter: Jens Geyer
{{lib/py/src/server/THttpServer.py}} parses the header with a bare {{int()}}
({{:100}}):
{code:python}
length = self.headers['Content-Length']
...
length = int(length)
...
self.send_error(400, "Invalid Content-Length")
{code}
Python's {{int()}} is more permissive than RFC 9110's grammar for the field,
which is one or more digits and nothing else. It accepts a leading sign
({{+12}}), surrounding whitespace ({{" 12 "}}) and PEP 515 underscores
({{1_2}}), so all three are taken as a length of 12 and the request is served.
A peer and this server can therefore disagree about whether a message is well
formed.
The D binding answered the same question for its HTTP transport in "Read HTTP
header names and wire numbers against their grammars".
h2. Suggested fix
Require the field to match {{^[0-9]+$}} before converting, and send the 400
that is already prepared for the malformed case otherwise.
_Drafted with AI assistance (Claude Opus 5); reviewed and filed by Jens Geyer._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
